I used to use TrendMicro PC-Cillin as my antivirus. Since, I have upgraded
and am now using Trend Micro PC-Cillin Internet Security 2005.

Can you tell if it is the older program (that I supposedly uninstalled) that
is causing the problem or the newer version? I updated it through Trend Micro
website, so I don't have the CD. I updated two other computers with it and am
having no problems with those.



"David Candy" wrote:

Do you use PC-cillin anti virus program by Trend Micro. Can you reinstall it, ie have the disk it came on? If so uninstall it. Reenable verifier. See if that fixes the problem.

tmtdi.sys is a file from that program.

If you have problems uninstalling it see
http://uk.trendmicro-europe.com/ente...lutionId=15505
Microsoft (R) Windows Debugger Version 6.3.0017.0

Copyright (c) Microsoft Corporation. All rights reserved.



Loading Dump File [C:\Documents and Settings\David Candy\Desktop\Mini032105-02.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols

Executable search path is:

Unable to load image ntoskrnl.exe, Win32 error 2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS Personal

Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20

Debug session time: Tue Mar 22 13:35:27 2005

System Uptime: 0 days 0:00:26.625

Unable to load image ntoskrnl.exe, Win32 error 2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

Loading Kernel Symbols

.................................................. .................................................. ..................................

Loading unloaded module list

....

Loading User Symbols

************************************************** *****************************

* *

* Bugcheck Analysis *

* *

************************************************** *****************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {80564468, 2, 0, 80564468}

Unable to load image tmtdi.sys, Win32 error 2

*** WARNING: Unable to verify timestamp for tmtdi.sys

*** ERROR: Module load completed but symbols could not be loaded for tmtdi.sys

Probably caused by : tmtdi.sys ( tmtdi+fdb )

Followup: MachineOwner

---------

kd !analyze -v

************************************************** *****************************

* *

* Bugcheck Analysis *

* *

************************************************** *****************************

IRQL_NOT_LESS_OR_EQUAL (a)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high. This is usually

caused by drivers using improper addresses.

If a kernel debugger is available get the stack backtrace.

Arguments:

Arg1: 80564468, memory referenced

Arg2: 00000002, IRQL

Arg3: 00000000, value 0 = read operation, 1 = write operation

Arg4: 80564468, address which referenced memory

Debugging Details:

------------------



READ_ADDRESS: 80564468

CURRENT_IRQL: 2

FAULTING_IP:

nt!ObReferenceObjectByHandle+0

80564468 ?? ???

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 8066b8a5 to 80564468

STACK_TEXT:

ba5f9b50 8066b8a5 000000f4 00100000 825602c0 nt!ObReferenceObjectByHandle

ba5f9b74 ec0b0fdb 000000f4 00100000 825602c0 nt!VerifierReferenceObjectByHandle+0x1e

WARNING: Stack unwind information not available. Following frames may be wrong.

00000000 00000000 00000000 00000000 00000000 tmtdi+0xfdb



FAILED_INSTRUCTION_ADDRESS:

nt!ObReferenceObjectByHandle+0

80564468 ?? ???

FOLLOWUP_IP:

tmtdi+fdb

ec0b0fdb ?? ???

SYMBOL_STACK_INDEX: 2

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: tmtdi+fdb

MODULE_NAME: tmtdi

IMAGE_NAME: tmtdi.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 41eced60

STACK_COMMAND: kb

BUCKET_ID: 0xA_CODE_AV_BAD_IP_tmtdi+fdb

Followup: MachineOwner

---------




--
----------------------------------------------------------

"bogey61944" wrote in message ...
Okay, just sent the two I got this evening.

I am on the computer now, had to start with "Last Known Good Configuration"
in order not to get the Stop error and Blue Screen.

I am eagerly awaiting your response! Thanks again!




----------------------------------------------------------

"bogey61944" wrote in message ...
Okay, ran verifier and got the BSOD when I rebooted. It said the following:

IRQL_NOT_LESS_OR_EQUAL
Stop 0x-0000000A (0x80564468, 0x-00000002, 0x-00000000, 0x80564468)

Event Viewer had this to say for today:

Monday, March 21, 2005 DCOM DCOM got error "%1084" attempting to start the
service netman with arguments "" in order to run the server:
{BA126AE5-2166-11D1-B 1D0-00805FC1270E}

Monday, March 21, 2005 DCOM DCOM got error "%1084" attempting to start the
service netman with arguments "" in order to run the server:
{BA126AE5-2166-11D1-B 1D0-00805FC1270E}

Monday, March 21, 2005 DCOM DCOM got error "%1084" attempting to start the
service EventSystem with arguments "" in order to run the server:
{1BE1F766-5536-11D1-B 726-00C04FB926AF}

Monday, March 21, 2005 Service Control Manager The DHCP Client service
depends on the NetBios over Tcpip service which failed to start because of
the following error: A device attached to the system is not functioning.

Monday, March 21, 2005 Service Control Manager The DNS Client service
depends on the TCP/IP Protocol Driver service which failed to start because
of the following error: A device attached to the system is not functioning.

Monday, March 21, 2005 Service Control Manager The TCP/IP NetBIOS Helper
service depends on the AFD Networking Support Environment service which
failed to start because of the following error: A device attached to the
system is not functioning.

Monday, March 21, 2005 Service Control Manager The IPSEC Services service
depends on the IPSEC driver service which failed to start because of the
following error: A device attached to the system is not functioning.

Monday, March 21, 2005 Service Control Manager The Trend Micro Proxy Service
service depends on the Trend Micro TDI Driver service which failed to start
because of the following error: A device attached to the system is not
functioning.

Monday, March 21, 2005 Service Control Manager The following boot-start or
system-start driver(s) failed to load: AFD Fips intelppm IPSec MRxSmb NetBIOS
NetBT RasAcd Rdbss Tcpip tmtdi WS2IFSL

Monday, March 21, 2005 DCOM DCOM got error "%1084" attempting to start the
service EventSystem with arguments "" in order to run the server:
{1BE1F766-5536-11D1-B 726-00C04FB926AF}

Monday, March 21, 2005 DCOM DCOM got error "%1058" attempting to start the
service iPodService with arguments "-Service" in order to run the server:
{7A7FB085-6068-4898-8 CCA-480A9187277C}

Monday, March 21, 2005 Print Printer hp photosmart 1215 series failed to
initialize because a suitable hp photosmart 1215 series driver could not be
found.

Monday, March 21, 2005 DCOM DCOM got error "%1058" attempting to start the
service iPodService with arguments "-Service" in order to run the server:
{7A7FB085-6068-4898-8 CCA-480A9187277C}

Monday, March 21, 2005 Print Printer hp photosmart 1215 series failed to
initialize because a suitable hp photosmart 1215 series driver could not be
found.

Monday, March 21, 2005 System Error Error code 1000000a, parameter1
80564468, parameter2 00000002, parameter3 00000000, parameter4 80564468.


Not sure why I am continuing to get the errors about the HP Photosmart 1215,
it is no longer on the system (used "remove this printer" in the Control
Panel/Printers & faxes area.

I have 2 minidumps from today but not sure what to do with them as I don't
have the XP disk (came loaded on computer) to load the Dumpchk.exe file.

Now what?




"David Candy" wrote:

The reason you should display blue screens is if you blue screen while booting. Then you won't be able to boot to read event viewer.

--
----------------------------------------------------------

"David Candy" . wrote in message ...
Verifier WILL cause blue screens. When ever a driver does the wrong thing windows will catch it and blue screen. The error message is critical as is likely to be more accurate than a non verifier blue screen. Without verifier on one has to wait for a driver, that may not have caused the error, to attempt to do something really bad.

So without verifier - a driver errors and sends garbage to another driver which can't cope and raises a blue screen error. With verifier hopefully the computer blue screens when the faulty driver does something.

I would suggest that you get windows to display the blue screen rather than restart. It tells you how on the same page as how to make mini dumps.

--
----------------------------------------------------------

"bogey61944" wrote in message ...
I don't have the CD as XP was already loaded on my system. I tried to run
verifier before but the system would shut down every time I requested it to
verify the drivers.

I will send you a dump this evening and also try verifier again. Thanks!



"David Candy" wrote:

Only System Error are blue screens. Yours are undocumented but all documented ones that start with a 1 have the same meanings as those that start with 0. So we'll assume that

0x1000000a = 0xa (10 in decimal)
0x100000c5 = 0xc (12 in decimal)

[0x prefixed means hexidecimal or base16)

Parameter 4 is the memory address where the error occured. 0x8054b534 in your case (for 0xa and nearby for the 0xc case).

Pstat can tell you what driver is loaded at what address. Install the Windows Support Tools from XP's CD. They left it out of the help file. Just type pstat in a command prompt. The bottom section will list drivers and their memory address. Match your param 4 on this list. Param 1 is memory it tried to read, param 2 is the IRQL, and for param 3 0 means read and 1 write. Remember this is all in base 16, 1, 2, 3, 4, 5, 6, 7, 8, 9, a, b, c, d, e, 10. So 0x10 is 16 decimal. Calculator can convert for you if needed in scientific mode.

AND/OR

Type verifier in Start - Run and follow the wizard. This will make all drivers slower but error messages should contain the driver's name and all drivers get checked as they work. The error code may change as Windows is strict with drivers.

AND/OR

mail me a minidump. Type in Help, Small Memory Dump.
--
----------------------------------------------------------

"bogey61944" wrote in message ...
I have been trying to deal with this problem for about 6 months. I am at my
wits end! Hopefully someone can help me. I am not super computer saavy but
can follow dirctions!

Randomly, my computer goes to the BSOD. It could be immediately after it
boots up and I get my desktop, or while on the net or working on a program.
No rhyme nor reason.

I suspect that it is a bad driver but have no idea how to figure out which
one. I have stripped the computer down to just the CPU, monitor keyboard and
mouse and it still happens.

Below is the error log from today ONLY! URRRRGGGG!

Saturday, March 19, 2005 W32Time Time Provider NtpClient: An error occurred
during DNS lookup of the manually configured peer 'time.windows.com,0x1'.
NtpClient will try the DNS lookup again in 15 minutes. The error was: A
socket operation was attempted to an unreachable host. (0x80072751)

Saturday, March 19, 2005 W32Time The time provider NtpClient is configured
to acquire time from one or more time sources, however none of the sources
are currently accessible. No attempt to contact a source will be made for 14
minutes. NtpClient has no source of accurate time.

Saturday, March 19, 2005 W32Time Time Provider NtpClient: An error occurred
during DNS lookup of the manually configured peer 'time.windows.com,0x1'.
NtpClient will try the DNS lookup again in 15 minutes. The error was: A
socket operation was attempted to an unreachable host. (0x80072751)

Saturday, March 19, 2005 W32Time The time provider NtpClient is configured
to acquire time from one or more time sources, however none of the sources
are currently accessible. No attempt to contact a source will be made for 15
minutes. NtpClient has no source of accurate time.

Saturday, March 19, 2005 W32Time Time Provider NtpClient: An error occurred
during DNS lookup of the manually configured peer 'time.windows.com,0x1'.
NtpClient will try the DNS lookup again in 15 minutes. The error was: A
socket operation was attempted to an unreachable host. (0x80072751)

Saturday, March 19, 2005 W32Time The time provider NtpClient is configured
to acquire time from one or more time sources, however none of the sources
are currently accessible. No attempt to contact a source will be made for 14
minutes. NtpClient has no source of accurate time.

Saturday, March 19, 2005 System Error Error code 100000c5, parameter1
00000c4b, parameter2 00000002, parameter3 00000001, parameter4 8054b534.

Saturday, March 19, 2005 DCOM DCOM got error "%1084" attempting to start the
service EventSystem with arguments "" in order to run the server:
{1BE1F766-5536-11D1-B 726-00C04FB926AF}

Saturday, March 19, 2005 DCOM DCOM got error "%1084" attempting to start the
service netman with arguments "" in order to run the server:
{BA126AE5-2166-11D1-B 1D0-00805FC1270E}

Saturday, March 19, 2005 DCOM DCOM got error "%1084" attempting to start the
service netman with arguments "" in order to run the server:
{BA126AE5-2166-11D1-B 1D0-00805FC1270E}

Saturday, March 19, 2005 Service Control Manager The DHCP Client service
depends on the NetBios over Tcpip service which failed to start because of
the following error: A device attached to the system is not functioning.

Saturday, March 19, 2005 Service Control Manager The DNS Client service
depends on the TCP/IP Protocol Driver service which failed to start because
of the following error: A device attached to the system is not functioning.

Saturday, March 19, 2005 Service Control Manager The TCP/IP NetBIOS Helper
service depends on the AFD Networking Support Environment service which
failed to start because of the following error: A device attached to the
system is not functioning.

Saturday, March 19, 2005 Service Control Manager The IPSEC Services service
depends on the IPSEC driver service which failed to start because of the
following error: A device attached to the system is not functioning.

Saturday, March 19, 2005 Service Control Manager The Trend Micro Proxy
Service service depends on the Trend Micro TDI Driver service which failed to
start because of the following error: A device attached to the system is not
functioning.

Saturday, March 19, 2005 Service Control Manager The following boot-start or
system-start driver(s) failed to load: AFD Fips intelppm IPSec MRxSmb NetBIOS
NetBT RasAcd Rdbss Tcpip tmtdi WS2IFSL

Saturday, March 19, 2005 DCOM DCOM got error "%1084" attempting to start the
service EventSystem with arguments "" in order to run the server:
{1BE1F766-5536-11D1-B 726-00C04FB926AF}

Saturday, March 19, 2005 Print Printer hp photosmart 1215 series failed to
initialize because a suitable hp photosmart 1215 series driver could not be
found.
(I deleted this old printer fro the system today)

Saturday, March 19, 2005 W32Time Time Provider NtpClient: An error occurred
during DNS lookup of the manually configured peer 'time.windows.com,0x1'.
NtpClient will try the DNS lookup again in 15 minutes. The error was: A
socket operation was attempted to an unreachable host. (0x80072751)

Saturday, March 19, 2005 W32Time The time provider NtpClient is configured
to acquire time from one or more time sources, however none of the sources
are currently accessible. No attempt to contact a source will be made for 14
minutes. NtpClient has no source of accurate time.

Saturday, March 19, 2005 W32Time Time Provider NtpClient: An error occurred
during DNS lookup of the manually configured peer 'time.windows.com,0x1'.
NtpClient will try the DNS lookup again in 15 minutes. The error was: A
socket operation was attempted to an unreachable host. (0x80072751)

Saturday, March 19, 2005 W32Time The time provider NtpClient is configured
to acquire time from one or more time sources, however none of the sources
are currently accessible. No attempt to contact a source will be made for 14
minutes. NtpClient has no source of accurate time.

Saturday, March 19, 2005 W32Time Time Provider NtpClient: An error occurred
during DNS lookup of the manually configured peer 'time.windows.com,0x1'.
NtpClient will try the DNS lookup again in 15 minutes. The error was: A
socket operation was attempted to an unreachable host. (0x80072751)

Saturday, March 19, 2005 W32Time The time provider NtpClient is configured
to acquire time from one or more time sources, however none of the sources
are currently accessible. No attempt to contact a source will be made for 14
minutes. NtpClient has no source of accurate time.

Saturday, March 19, 2005 W32Time Time Provider NtpClient: An error occurred
during DNS lookup of the manually configured peer 'time.windows.com,0x1'.
NtpClient will try the DNS lookup again in 15 minutes. The error was: A
socket operation was attempted to an unreachable host. (0x80072751)

Saturday, March 19, 2005 W32Time The time provider NtpClient is configured
to acquire time from one or more time sources, however none of the sources
are currently accessible. No attempt to contact a source will be made for 14
minutes. NtpClient has no source of accurate time
.
Saturday, March 19, 2005 System Error Error code 1000000a, parameter1
80564468, parameter2 00000002, parameter3 00000000, parameter4 80564468.

Saturday, March 19, 2005 System Error Error code 1000000a, parameter1
80564468, parameter2 00000002, parameter3 00000000, parameter4 80564468.

Saturday, March 19, 2005 System Error Error code 100000c5, parameter1
002713ed, parameter2 00000002, parameter3 00000001, parameter4 8054b534.

Saturday, March 19, 2005 System Error Error code 100000c5, parameter1
009a8236, parameter2 00000002, parameter3 00000001, parameter4 8054b534.

Saturday, March 19, 2005 System Error Error code 100000c5, parameter1
00000004, parameter2 00000002, parameter3 00000001, parameter4 8054b534.


I have Trend Micro PC-Cillin Internet Security 2005 as Antivirus software.
Any ideas??